Severity: Moderate
Affected versions:
- Apache Roller 6.1.6
Description:
Improper Neutralization of Input During Web Page Generation ('Cross-site
Scripting') in Apache Roller 6.1.6 allows an authenticated user with the Author
role on a weblog that uses a custom theme to store script that runs in the
browser of anyone who opens the file's resource URL. The fix for CVE-2026-82387
serves uploaded media as a download unless it is an image, audio, video, PDF or
plain text, but media files found through a custom theme were served with the
type their path implies, and the upload form let the uploader choose that path.
Media uploads are disabled by default. Users are recommended to upgrade to
Apache Roller 6.1.7 or later, which serves these files under the same rules as
other media and no longer accepts the path from the upload form.
Credit:
VNCS-dacqu4n (finder)
References:
https://github.com/apache/roller/pull/217
https://roller.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-111824
